First Major Sanctions Under Personal Data Law
By Robalino

The Superintendencia de Protección de Datos Personales (SPDP) of Ecuador announced its first major sanctions against two national institutions for breaches of Ecuador’s data protection law. These actions mark the first time the agency has applied administrative penalties under the LOPDP’s enforcement framework.
The sanctioned organizations are:
-Liga Profesional de Fútbol del Ecuador (LIGAPRO)
-Federación Ecuatoriana de Fútbol (FEF)
The Liga Profesional de Fútbol del Ecuador, commonly known as LigaPro, is the organization responsible for organizing and managing Ecuador’s professional football leagues. The Federación Ecuatoriana de Fútbol (FEF) is the official governing body of football in Ecuador.
Both were found to have violated data protection standards in connection with personal data processed through their fan-oriented mobile applications (“Fan ID” and “Fan FEF”).
After information requests, inspections, and corrective procedures, the SPDP determined that neither organization implemented sufficient administrative, technical, and legal safeguards to ensure lawful and secure data processing.
Sanctions Imposed
-LIGAPRO: Fined USD 259,644.01 and required to notify more than 14,000 data subjects whose consent was not validly obtained; the organization must also delete these records from all systems.
-FEF: Fined USD 194,856.16 and ordered to update its internal data protection practices, implement a compliant data policy, notify affected users about invalid consent, and eliminate improperly processed data.
